Security
Security Headers Checker
Check whether a site sends the HTTP response headers that protect against XSS, clickjacking, and MIME-type sniffing.
This checks the headers on the initial response only — it doesn't evaluate whether a Content-Security-Policy's actual rules are strict enough, just whether one is present.
About this tool
Comprehensive documentation & audit utility guideA handful of HTTP response headers tell the browser to enforce extra protections on a page's behalf — blocking script injection, preventing the page from being framed by another site, and forcing HTTPS. None of them require server-side logic changes, just configuration, so a missing header is usually an easy fix.
How it works
1
Enter a URL
Any public page you want to check.
2
We fetch its response headers
The same headers a browser receives on the first request.
3
Review each one
See what's present, what's missing, and what each header actually does.
What it checks
Content-Security-Policy
Strict-Transport-Security (HSTS)
X-Frame-Options
X-Content-Type-Options
Referrer-Policy
Permissions-Policy
Cross-Origin-Opener-Policy / Cross-Origin-Resource-Policy